Date: Wed, 05 Dec 2012 17:48:33 -0600 From: Tim Daneliuk <tundra@tundraware.com> Cc: FreeBSD Mailing List <freebsd-questions@freebsd.org> Subject: Re: Somewhat OT: Is Full Command Logging Possible? Message-ID: <50BFDD51.5000100@tundraware.com> In-Reply-To: <CADy1Ce5CCA4ExOok4DndA4C-MazbegZY1OKztCNqUZHGzLJgTA@mail.gmail.com> References: <50BFD674.8000305@tundraware.com> <CADy1Ce5CCA4ExOok4DndA4C-MazbegZY1OKztCNqUZHGzLJgTA@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 12/05/2012 05:44 PM, Kurt Buff wrote: > On Wed, Dec 5, 2012 at 3:19 PM, Tim Daneliuk <tundra@tundraware.com> wrote: >> I am working with an institution that today provides limited privilege >> escalation >> on their servers via very specific sudo rules. The problem is that the >> administrators can do 'sudo su -'. > <snip> > > > sudo is misconfigured. > > man 5 sudoers and man 8 visudo > > > > Kurt > I'm sorry Kurt, I'm sort of dense today, I'm not sure what you're saying. Are you suggesting that there is a way to configure sudo so that if someone does 'sudo su -' to become an admin, sudo can be made to log every command they execute thereafter? -- ---------------------------------------------------------------------------- Tim Daneliuk tundra@tundraware.com PGP Key: http://www.tundraware.com/PGP/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?50BFDD51.5000100>